 (s/defschema Investigation
   (st/merge (f-schema/->schema inv/Investigation)
             CTIAEntity
-            {s/Keyword s/Any}))
+            {(s/required-key :actions) (s/either s/Str {s/Keyword s/Any})
+             (s/required-key :object_ids) [s/Str]
+             ;; "type:value"
+             (s/required-key :investigated_observables [s/Str])
+             (s/required-key :targets [(f-schema/->schema IdentitySpecification)])
+             s/Keyword s/Any}))
 
 (f-spec/->spec inv/Investigation "investigation")
 

            [ctia.stores.es
             [mapping :as em]
             [store :refer [def-es-store]]]
            [ctim.schemas.investigation :as inv]
            [flanders
             [schema :as f-schema]

                :include_in_all false}
   :targets {:type "nested"
             :include_in_all false}
   :investigated_observables {:type "text"
                              :analyzer "text_analyzer"
                              :search_quote_analyzer "text_analyzer"
                              :search_analyzer "search_analyzer"
                              :include_in_all false}})

(def investigation-mapping
